IntelMQ
AGPL-3.0馃 Threat Intelligence 路 Python
IntelMQ is a solution for IT security teams (CERTs, CSIRTs, abuse departments) to collect and process security feeds, pastebins, and tweets using a message queue protocol. It provides a modular bot framework where collector bots fetch data from sources, parser bots normalize it into a standard format (IDEA), expert bots enrich and filter, and output bots distribute to databases, ticketing systems, or downstream tools. IntelMQ handles hundreds of feed formats (abuse.ch, Shadowserver, MISP, PhishTank, etc.) and deduplicates across sources. The web management interface (IntelMQ Manager) allows visual pipeline configuration and monitoring.
Installation
$ pip install intelmqUse Cases
- Automated collection and normalization of threat feeds
- CERT/CSIRT incident handling automation
- Enriching IOCs with contextual information
- Distributing processed intelligence to downstream systems
Tags
Details
- Category
- 馃 Threat Intelligence
- Language
- Python
- Repository
- certtools/intelmq
- License
- AGPL-3.0
- Platforms
- 馃惂linux
Links
Used in 1 Workflow
Community Reviews
Alternatives & Comparisons
MISP
PHP/PythonOpen-source threat intelligence and sharing platform. Structured IOC management, feeds, correlation, and STIX/TAXII export.
Compare IntelMQ vs MISPOpenCTI
TypeScript/PythonCyber threat intelligence platform. Knowledge management for threat data with STIX2 native storage and graph visualization.
Compare IntelMQ vs OpenCTIMore in Threat Intelligence
MISP
PHP/PythonOpen-source threat intelligence and sharing platform. Structured IOC management, feeds, correlation, and STIX/TAXII export.
OpenCTI
TypeScript/PythonCyber threat intelligence platform. Knowledge management for threat data with STIX2 native storage and graph visualization.
TheHive
Scala/JavaScriptIncident response case management platform. Collaborative investigation with observable analysis, playbooks, and MISP integration.
GRR Rapid Response
PythonRemote live forensics framework by Google. Deploy agents across thousands of endpoints for artifact collection and analysis.
KAPE
C#Kroll Artifact Parser and Extractor. Fast triage collection and parsing of forensic artifacts from Windows, macOS, and Linux.
Cortex
Scala/PythonObservable analysis and active response engine. Analyze IOCs at scale with 100+ analyzers for IPs, hashes, URLs, and domains.